GlassWorm Attack: Invisible Unicode Code Strikes 151 GitHub Repos and 72 VS Code Extensions

The Invisible Threat Hiding in Plain Sight

Between March 3 and March 9, 2026, at least 151 GitHub repositories were compromised by a threat actor tracked as GlassWorm, which hides malicious payloads in Unicode Private Use Area (PUA) characters — ranges 0xFE00 through 0xFE0F and 0xE0100 through 0xE01EF that render as zero-width whitespace in virtually every code editor and terminal [2][4]. To a human reviewing a pull request, the injected code appears as an empty string. But when the JavaScript runtime encounters it, a small decoder extracts the hidden bytes and passes them to eval(), executing a full malicious payload [2]

This is not a new technique — GlassWorm has been active since at least March 2025, when Aikido Security first discovered malicious npm packages using the same invisible Unicode method [2]. By October 2025, the attacker had expanded to Open VSX extensions, and by March 2026, launched a coordinated mass campaign across GitHub, npm, and VS Code marketplace [1][2][3].​‌‌​​‌‌‌‍​‌‌​‌‌​​‍​‌‌​​​​‌‍​‌‌‌​​‌‌‍​‌‌‌​​‌‌‍​‌‌‌​‌‌‌‍​‌‌​‌‌‌‌‍​‌‌‌​​‌​‍​‌‌​‌‌​‌‍​​‌​‌‌​‌‍​‌‌‌​‌‌​‍​‌‌‌​​‌‌‍​‌‌​​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​​‌​​‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​​​‍​‌‌‌​​​​‍​‌‌​‌‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌​​​‌‌‍​‌‌​‌​​​‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​​‌​‌‌​‌‍​‌‌​​​​‌‍​‌‌‌​‌​​‍​‌‌‌​‌​​‍​‌‌​​​​‌‍​‌‌​​​‌‌‍​‌‌​‌​‌‌‍​​‌​‌‌​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌‌​‌‌​‍​‌‌​‌​​‌‍​‌‌‌​​‌‌‍​‌‌​‌​​‌‍​‌‌​​​‌​‍​‌‌​‌‌​​‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌‌​‌​‌‍​‌‌​‌‌‌​‍​‌‌​‌​​‌‍​‌‌​​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​​‌​​‍​‌‌​​‌​‌‍​​‌​‌‌​‌‍​‌‌​​‌​​‍​‌‌​​‌​‌‍​‌‌‌​‌‌​‍​‌‌​​‌​‌‍​‌‌​‌‌​​‍​‌‌​‌‌‌‌‍​‌‌‌​​​​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​‌‌‌​​‌‌

Why This Matters for Your Business

For SMBs with software teams, this attack targets the developer workstation — the machine with access to source code, CI/CD tokens, cloud credentials, and production secrets. Once executed, the GlassWorm payload establishes a foothold that can exfiltrate:

• GitHub tokens and repository access
• CI/CD pipeline credentials (Jenkins, GitHub Actions, GitLab CI)
• Cloud API keys (AWS, Azure, GCP)
• Database connection strings
• SSH keys and deployment credentials
• Environment variables from .env files

The attack is particularly dangerous because it bypasses visual code review — the malicious code is literally invisible to the human eye. Standard linters and static analysis tools won't catch it unless they specifically scan for PUA Unicode characters [2][4].

How GlassWorm Works: The Technical Breakdown

Phase 1: Invisible Unicode Injection

The attack begins with a commit that appears legitimate. Researchers at Aikido Security note that the malicious injections don't arrive in obviously suspicious commits. Instead, they take the form of version bumps, small refactors, documentation tweaks, and bug fixes that are "stylistically consistent with each target project" [2]. This level of project-specific tailoring strongly suggests the attackers are using large language models (LLMs) to generate convincing cover commits — manually crafting 151+ bespoke code changes across different codebases simply isn't feasible at this scale [2].

Buried within these commits is the invisible Unicode payload. Here's what the decoder pattern looks like (note the apparent gap in the empty backticks):

const s = v => [...v].map(w => (
  w = w.codePointAt(0),
  w >= 0xFE00 && w <= 0xFE0F ? w - 0xFE00 :
  w >= 0xE0100 && w <= 0xE01EF ? w - 0xE0100 + 16 : null
)).filter(n => n !== null);

eval(Buffer.from(s(``)).toString('utf-8'));

The backtick string passed to s() looks empty in every viewer, but it's packed with invisible characters that decode to a full malicious payload [2].

Phase 2: Solana-Based Command-and-Control

Once decoded and executed, the payload fetches and executes a second-stage script using the Solana blockchain as a delivery channel [1][4]. This is a sophisticated technique:

• Dead drop resolver: The malware reads Solana transaction memos to retrieve the C2 server address, making the infrastructure resilient to takedowns — blockchain transactions cannot be modified or deleted [3][4].
• Infrastructure rotation: The campaign has shifted from Solana wallet BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC to 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ, adding new C2 IPs 45.32.151.157 and 70.34.242.255 while continuing to reuse 45.32.150.251 [3].
• Execution guardrails: The malware uses Russian locale and timezone geofencing to avoid infecting systems in Russian locales, likely to evade detection by Russian security researchers or law enforcement [3][4].

Phase 3: Credential and Secret Theft

The ultimate goal is credential harvesting. Once established on a developer workstation, the malware searches for:

• Tokens and credentials stored in configuration files
• Environment variables (especially from .env files)
• CI/CD pipeline secrets (Jenkins, GitHub Actions tokens)
• Cloud provider credentials (AWS, Azure, GCP API keys)
• SSH keys and private certificates
• Cryptocurrency wallet keys (historically targeted by GlassWorm) [1][4]

These exfiltrated credentials give the attacker persistent access to your infrastructure, enabling data theft, ransomware deployment, or supply chain propagation to your customers.

The New Transitive Dependency Attack Vector

The most alarming evolution in the March 2026 wave is GlassWorm's abuse of VS Code extension relationships. On March 13, 2026, Socket Research reported identifying at least 72 additional malicious Open VSX extensions that use a new transitive delivery technique [1][3].

Abusing extensionPack and extensionDependencies

VS Code and compatible editors support two manifest fields in package.json:

• extensionPack: Bundles related extensions together (e.g., a "PHP Development" pack that includes a debugger and language server).
• extensionDependencies: Declares extensions required for the parent extension to function [3].

When a user installs an extension with these fields, the editor automatically installs every referenced extension. Critically, any extension author can declare any other extension — no trust relationship required [3].

GlassWorm's new technique:

1. Attacker publishes an extension that appears benign and standalone.
2. Developer installs and trusts the extension.
3. In a later update, the attacker adds extensionPack or extensionDependencies referencing a separate GlassWorm loader.
4. The editor automatically installs the malicious dependency in the background [1][3].

This means an extension that looked safe when you installed it can become malicious through an update — and standard one-time code reviews won't catch it.

Real-World Examples

Socket confirmed this pattern in several extensions:

• otoboss.autoimport-extension references oigotm.my-command-palette-extension and federicanc.dotenv-syntax-highlighting (confirmed GlassWorm-linked) [3].
• twilkbilk.color-highlight-css — a typosquat of the legitimate color-highlight extension, showing 3,500 downloads (likely inflated to appear credible) [3].
• daeumer-web.es-linter-for-vs-code — publisher name is a direct typosquat of legitimate ESLint publisher dbaeumer [3].

The extensions impersonate widely-used tools: ESLint, Prettier, code runners, Angular/Flutter/Python tooling, WakaTime, Better Comments, and AI assistants like Claude Code, Codex, and Antigravity [1][3].

Business Impact and Risk Assessment

For SMBs with Development Teams

If your business employs developers who use VS Code or pull from public GitHub repositories, your risk factors include:

Notable Targets Validate the Threat

Among the 151 compromised GitHub repositories are several well-known projects with meaningful star counts [2]:

• pedronauck/reworm — 1,460 stars
• pedronauck/spacefold — 62 stars
• anomalyco/opencode-bench — 56 stars (from anomalyco, the organization behind OpenCode and SST)
• doczjs/docz-plugin-css — 39 stars
• wasmer-examples/hono-wasmer-starter — 8 stars (Wasmer is a WebAssembly runtime)

These are real projects that developers depend on. If your team uses any of these libraries or similar packages, you may have inadvertently pulled malicious code.

Defensive Actions: What to Do Right Now

Immediate Steps (Next 24 Hours)

1. Audit VS Code extensions on all developer workstations:

   code --list-extensions --show-versions

   Cross-reference against the full list of 72 malicious extensions [3].

2. Check for invisible Unicode in your repositories:

   # Search for the decoder pattern
   grep -r "0xFE00" . || echo "No matches found"

   Or use Aikido's free malware detection [2].

3. Rotate exposed credentials if you find suspicious extensions:

   • GitHub personal access tokens
   • CI/CD pipeline secrets (Jenkins, GitHub Actions, GitLab CI)
   • Cloud API keys (AWS, Azure, GCP)
   • Database credentials
   • SSH keys

4. Review extension version history for newly introduced extensionPack or extensionDependencies:

   # For each installed extension, check versions
   code --list-extensions | while read ext; do
     echo "Checking: $ext"
   done

Long-Term Defenses

1. Implement automated scanning for invisible Unicode in CI/CD pipelines — tools like Aikido and Socket can detect these payloads automatically [2][3].

2. Require security review for extension updates — not just initial installation. Monitor for manifest changes in later versions [3].

3. Lock dependency versions in package-lock.json, yarn.lock, or pnpm-lock.yaml to prevent automatic updates to compromised versions.

4. Segment developer workstations from production infrastructure — developers shouldn't have direct access to production credentials from their dev machines.

5. Use GitHub's Dependabot and security advisories to receive alerts about compromised dependencies.

The Larger Context: Supply Chain Attacks Are the New Normal

GlassWorm is part of a broader trend: software supply chain attacks are increasing because they're efficient. Instead of attacking your defenses directly, attackers compromise the tools and libraries you trust.

Recent precedents include:

• SolarWinds (2020): Compromised build process delivered malware to 18,000+ customers via Orion updates.
• Codecov (2021): Uploader script modified to exfiltrate credentials from CI environments.
• Event-stream (2018): Malicious npm package stolen Bitcoin from developer wallets.
• ua-parser-js (2021): 1,800+ packages infected via malware in a popular dependency.

GlassWorm is notable for its use of invisible Unicode and blockchain-based C2, but the core strategy — compromising developer tools to steal credentials — is well-established [1][2][4].

Why AI Makes This Worse

Researchers strongly suspect GlassWorm is using LLMs to generate cover commits [2]. This lowers the attacker's cost: instead of manually crafting 151 realistic code changes, an AI can generate them automatically. As AI coding assistants become more common, we should expect:

• More sophisticated cover commits that are harder to detect
• Faster propagation across multiple ecosystems simultaneously
• AI-generated typosquatting and impersonation attempts

Cost-Benefit Analysis: Defending Against GlassWorm

For SMBs, the calculus is straightforward:

Recommended immediate investment: 4-6 hours of developer time to audit and rotate, plus automated scanning tooling (~$100/month) for ongoing protection.

Key Indicators of Compromise (IOCs)

Malicious Open VSX Extensions (Partial List)

Full list of 72 extensions [3]:

1. aadarkcode.one-dark-material
2. angular-studio.ng-angular-extension
3. crotoapp.vscode-xml-extension
4. gvotcha.claude-code-extension
5. gvotcha.claude-code-extensions
6. mswincx.antigravity-cockpit
7. mswincx.antigravity-cockpit-extension
8. otoboss.autoimport-extension
9. twilkbilk.color-highlight-css
10. daeumer-web.es-linter-for-vs-code

Solana Wallets

• BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC
• 6YGcuyFRJKZtcaYCCFba9fScNUvPkGXodXE1mJiSzqDJ

C2 IP Addresses

• 45.32.150.251
• 45.32.151.157
• 70.34.242.255

Embedded Crypto Material

• AES key: wDO6YyTm6DL0T0zJ0SXhUql5Mo0pdlSz
• AES IV (hex): c4b9a3773e9dced6015a670855fd32b

GitHub Decoder Pattern

w >= 0xFE00 && w <= 0xFE0F ? w - 0xFE00 :
w >= 0xE0100 && w <= 0xE01EF ? w - 0xE0100 + 16 : null

FAQ

grep -r "0xFE00" . || echo "No decoder pattern found"

References

1. Socket Research Team. "72 Malicious Open VSX Extensions Linked to GlassWorm Campaign Now Using Transitive Dependencies." Socket Dev Blog, March 13, 2026. https://socket.dev/blog/open-vsx-transitive-glassworm-campaign

2. Makari, Ilyas. "Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Hundreds of Repositories." Aikido Security Blog, March 14, 2026. https://www.aikido.dev/blog/glassworm-returns-unicode-attack-github-npm-vscode

3. The Hacker News. "GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers." March 14, 2026. https://thehackernews.com/2026/03/glassworm-supply-chain-attack-abuses-72.html

4. James, Luke. "Invisible malicious code attacks 151 GitHub repos and VS Code — Glassworm attack uses blockchain to steal tokens, credentials, and secrets." Tom's Hardware, March 14, 2026. https://www.tomshardware.com/tech-industry/cyber-security/malicious-packages-using-invisible-unicode-found-in-151-github-repos-and-vs-code

5. Aikido Security. "GitHub code search for decoder pattern returns 151+ repositories." March 2026. https://github.com/search?q=0xFE00%26%26w%3C%3D0xFE0F%3Fw-0xFE00%3Aw%3E%3D0xE0100%26%26w%3C%3D0xE01EF&type=code

6. Endor Labs. "Return of PhantomRaven: 88 Malicious npm Packages with Remote Dynamic Dependencies." February 2026. https://www.endorlabs.com/learn/return-of-phantomraven

7. Cybersecurity News. "GlassWorm Campaign Uses 72 Malicious Open VSX Extensions to Broaden Reach." March 14, 2026. https://cybersecuritynews.com/glassworm-campaign-uses-72-malicious-open-vsx-extensions/

8. Koi Security. "Self-Spreading GlassWorm Infects VS Code Marketplace." October 2025. https://koi.security/blog/glassworm-vscode-marketplace

Get Help Securing Your Development Pipeline

If you're concerned about supply chain security but don't know where to start, get expert guidance. A cybersecurity consultation can help you:

• Audit your current dependencies and extensions
• Implement automated scanning in your CI/CD pipeline
• Design credential rotation and incident response procedures
• Train your developers on secure coding practices

Book a free consultation →

Don't wait until your credentials are stolen. Proactive security is cheaper than a breach.

Disclosure: This post reports on publicly documented security research from Aikido Security, Socket, The Hacker News, Tom's Hardware, and Cybersecurity News. Always verify IOCs against primary sources and conduct your own testing before taking remediation actions.